topic Add _time field to macro results in Splunk Dev

Add _time field to macro results

jacqu3sy — Tue, 29 Sep 2020 18:29:39 GMT

Hi, I'm trying to work out a way of adding the existing time to results produced by running the following macro;

| suppression_eventtypes

I'm currently pulling back the following fields;

| fields suppression, start_time, end_time

With the intention being to create some logic which will return any suppression's with an end_time 7 days from the current time. I can work out the logic needed, but am struggling to pull the current time back within the results as it's not produced as a field from the macro.

any ideas? Thanks.

Re: Add _time field to macro results

richgalloway — Wed, 14 Mar 2018 18:26:49 GMT

The current time is available from the now function.

... | eval current_time=now() | ...

Re: Add _time field to macro results

niketn — Wed, 14 Mar 2018 20:00:52 GMT

@jacqu3sy, Based on the description seems like you need is relative_time() function to give you the epoch time 7 days from current time i.e.

| eval EndTimeThreshold=relative_time(now(),"+7d@d")

Following is a run anywhere search to test your end_time values (if it is string time the same needs to be converted to epoch time using strptime(). If it is already epoch timem, then strptime() is not required)

| makeresults
| eval end_time="2018/03/15"
| eval end_time=strptime(end_time,"%Y/%m/%d")
| eval EndTimeThreshold=relative_time(now(),"+7d@d")
| eval duration=EndTimeThreshold-end_time
| fieldformat EndTimeThreshold=strftime(EndTimeThreshold,"%Y/%m/%d %H:%M:%S")
| eval suppression=if(duration<=604800,"Within 7 Days","Outside 7 Days")

Please try out and confirm.

Re: Add _time field to macro results

jacqu3sy — Thu, 15 Mar 2018 10:12:21 GMT

great, thanks.

Re: Add _time field to macro results

jacqu3sy — Thu, 15 Mar 2018 10:12:36 GMT

Thats perfect. Many thanks.

Re: Add _time field to macro results

richgalloway — Thu, 15 Mar 2018 12:46:10 GMT

@jacqu3sy, if your problem is resolved, please accept the answer to help future readers.